New Wi-Fi sensing's cyber security implications

A groundbreaking technology emerging from UNSW is transforming how we think about surveillance, safety, and security. 

Dr Deepak Mishra, along with Professor Aruna Seneviratne and their team at GinigAI have developed a Wi-Fi-based sensing system that can detect everything from fires and unauthorised intrusions to battery failures – all without cameras or physical sensors. 

But this revolutionary technology sits at an intersection of cyber-physical security, raising both promising applications and important privacy considerations.

The technology: how it works 

The foundation of this technology begins with MIT researchers in 2015 who discovered that Wi-Fi signals are affected by objects and people between transmitter and receiver. 

Different materials and conditions create unique “signatures” in the signal – temperature changes, human movement, metal objects, water, and even fire all affect Wi-Fi waves in distinct, measurable patterns. 

Dr Mishra and Professor Seneviratne initially worked on Wi-Fi sensing technology to validate its robustness for object detection and human activity recognition. 

Together, they later explored new enabling applications of Wi-Fi sensing and successfully secured multiple research grants to advance this work.  

After founding GinigAI, the team advanced the concept by focusing not on the data being transmitted, but instead, how the wireless signal itself changes as it travels through different environments.

The devices themselves are remarkably simple: small microcontrollers with Wi-Fi chipsets. The real innovation lies in the machine learning algorithms that interpret these signal variations.  

By training the system on specific signatures, it can detect and identify various environmental changes and objects with remarkable precision – down to single-degree temperature variations.

“You don’t care what is being transmitted. What you care about is how the transmitted signal gets affected by the medium,” Mishra explains. 

Cyber security applications: defence and detection

The technology's most significant cyber security application lies in physical security and access control. Working with the Office of National Intelligence, Mishra’s team is developing systems that can detect unauthorised persons entering restricted areas, forbidden objects being brought into secure spaces, or restricted activities being performed – all without cameras that could compromise privacy or be easily defeated.

“The idea is to build a system which can tell if an unauthorised person is entering a building or a room, or a forbidden object being brought in like some kind of metallic knife,” Mishra, a member of the UNSW Institute for Cyber Security, says. 

The system can distinguish between authorised and unauthorised individuals based on their unique wireless signatures, and even detect specific materials such as metals that cannot penetrate Wi-Fi signals.

This capability extends to detecting metallic objects and batteries – substances with distinct electromagnetic properties. In testing with logistics company DP World, the technology is being deployed to prevent workplace accidents by detecting when maintenance workers are inside shipping containers, alerting forklift operators before dangerous collisions can occur.

The privacy paradox

The technology presents a fascinating paradox in the cyber-physical security landscape. On one hand, it offers significant privacy advantages over camera-based surveillance. The system doesn't capture images or identify individuals visually – it merely detects complex signal variations that have no inherent connection to personal identity.

“People don't care about Wi-Fi privacy at this stage,” Mishra says. 

“People even have Wi-Fi in their bathrooms. So they are happy to be under this kind of wireless technology because you can do all kinds of surveillance activities without actually affecting the privacy of a person.”

However, the flip side raises serious concerns. The technology’s ability to operate invisibly creates a unique vulnerability: subjects have no way of knowing they’re being monitored or to what extent. Unlike cameras with visible blind spots or coverage areas, Wi-Fi sensing penetrates walls and leaves no blind zones.

“You will never come to know that you are under surveillance,” Mishra says. “People are claiming that you can detect heartbeats. You can detect to that level of things. You can detect mood, for example, a person's mood.”

The technology can even infer device behaviour – what someone is typing, whether they’re playing audio or video – without ever accessing encrypted data or hacking the device itself. 

This represents a new category of side-channel surveillance that operates outside traditional cyber security frameworks.

Adversarial attacks and vulnerabilities

As with any security technology, the system faces potential adversarial attacks. 

If the technology can identify individuals by their wireless signatures, attackers could theoretically create spoofed signatures to impersonate authorised users or mask their true identity.

“People can try to spoof it by creating signatures that may confuse the technology – making you look like me or me look like you,” Mishra says. 

“When you want to use this technology for defence applications, people may start attacking it and it’s like they mask you.”

This cat-and-mouse dynamic is familiar in cyber security, but the physical nature of the attacks – manipulating electromagnetic signals in real-time – presents novel challenges for defenders. 

The solution lies in the mandate for transparency and consent: implementing “mandated sensing” where people are fully informed about what data is being collected and how it will be used.

Real-world applications and impact

Beyond security, the technology is finding practical applications across multiple industries, each with significant safety and economic implications:

Fire detection: The original application remains among the most promising. After successful tests in Sydney Harbour Tunnel – including detecting an actual car fire during a training exercise – the technology attracted attention from Lloyd's of London for maritime applications. On cargo ships, where fires can take 30 minutes to detect and cost $US150,000 per minute, the technology could save billions in losses annually.

Workplace safety: At DP World's container facilities, the system prevents potentially fatal accidents by detecting when workers are inside containers or in the path of forklifts. With workers at height and limited visibility, even a single prevented fatality justifies the technology investment.

Waste management: Veolia, experiencing one battery fire per week in garbage trucks worth up to $500,000 each, is testing the technology to detect batteries in bins before collection. The system can identify metallic objects with 80% accuracy, allowing drivers to flag problematic bins for manual inspection before compacting.

Battery safety: With $1.2 million in funding from the NSW government, the team is developing systems to predict battery thermal runaway – the dangerous overheating that causes fires in everything from power banks to electric vehicles. By detecting early warning signs, the technology could prevent catastrophic failures before they occur.

The speed advantage

Perhaps the technology's most compelling feature is its detection speed. Operating at the speed of light, it detects changes instantaneously – far faster than smoke detectors waiting for particles to reach sensors or temperature monitors responding to ambient changes.

“The signal goes and comes back with the speed of light, so it’s more proactive,” Mishra says. 

This near-instantaneous detection, combined with the ability to localise problems precisely through triangulation, makes the technology especially valuable in time-critical safety applications.

Looking forward

As Ginigai moves from research to commercialisation, the technology faces the challenge common to all novel innovations: proving itself in diverse real-world conditions. Each application requires custom training and testing, but early results suggest transformative potential across industries from maritime safety to healthcare, where the technology shows promise for early detection of conditions like Alzheimer’s through behavioural pattern changes.

The broader question remains how society will balance the technology’s clear safety and security benefits against its unprecedented surveillance capabilities.  
 
As Dr Mishra and his team continue refining the technology, the conversation around mandated sensing and transparency becomes not just advisable but essential – ensuring that innovation serves security without sacrificing the privacy it promises to protect.